---
sourceDocument: Australia Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/platform-security

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Create a cryptographic module with external key wrapping

# Create a cryptographic module with external key wrapping {#ariaid-title1}

Release version: Australia  
Updated March 12, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Create a cryptographic module that uses external Amazon Web Services Key Management System (AWS KMS) key wrapping to encrypt ServiceNow data.

## Before you begin

Roles required: admin, security_admin, and sn_kmf.cryptographic_manager

## About this task

A cryptographic module with external key wrapping generates encryption keys that are wrapped (encrypted) by your AWS KMS key in addition to ServiceNow's internal key management. ServiceNow can't decrypt your data without access to your external AWS key.

## Procedure

1. Navigate to AllSystem SecurityField Encryption Modules.
2. Select New.
3. Enter a name for the module in the Name field.
4. Select the External wrap key check box.  
   Important:  
   If Externally Wrap Key isn't selected, the module uses ServiceNow key wrapping, which doesn't use your AWS KMS key.
5. In the External KMS Configuration field, enter or use the search function to select your EKMS configuration.
6. Select Submit to save the cryptographic module.
{#create-cryptographic-module-external-key-wrapping__steps_zz2_dch_g3c}

## Result

The cryptographic module is created and ready to be used for encrypting Field Encryption data.

When you enable external key wrapping on an existing cryptographic module, all keys for this module are automatically rewrapped with your External Key Encryption Key (EKEK). This protects them with your EKMS key. Both
existing keys and future keys you create will be externally wrapped.

A security task is created to track the rewrapping process. To monitor the status, navigate to AllSecurity Center Security Task Manager and look for the task with description 'Module key rewrap process for crypto module \[module_id\]'. See [Security Tasks](https://www.servicenow.com/docs/qd3ZhynMRXewTLU8VJEJYA "Use Security Tasks to monitor, prioritize, and assign all your security-related tasks in one place.").

## What to do next

Next steps:

* [Create encrypted field configurations to specify which tables and columns to encrypt](https://www.servicenow.com/docs/LrJ3Hf40r26dNUMShsEvRw "Configure specific fields to be encrypted using your External Key Management Service (EKMS) cryptographic module with external Amazon Web Services Key Management System (AWS KMS) key wrapping.")
* [Set up module access policies to control who can view the encrypted data](https://www.servicenow.com/docs/yP8ydWgSMIloOWt9PkqvHw "Configure module access policies in External Key Management Service (EKMS) to control who can view encrypted data in clear text.")
{#create-cryptographic-module-external-key-wrapping__ul_e1f_dch_g3c}

*[\>]: and then